ClawHub
Back to skill

Security audit

Ethical Acquisition

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed planning-and-drafting workflow for ethical acquisition outreach, with external actions gated on specific human approval.

Before installing, understand that this skill is meant to help prepare outreach, listings, or other acquisition actions. It should be used only with legitimate account access and permissioned data, and you should review the exact payload, destination, account, cost, and rollback path before approving any external action.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
`Payable Test Plan`, including the buyer, payment condition, scope, evidence
label, cost and work ceilings, delivery authority, stop condition, and approval
checkpoint. Run Authorization permits private channel analysis, drafting, and
artifact creation without asking for another approval. Return to
`moneyprinter`, `offer-engine`, or `payable-test` when the route materially
changed or the offer cannot be presented honestly. Run Authorization never
permits a buyer-facing or account-mutating action.
Confidence
75% confidence
Finding
without asking

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
decline, and no unverified performance claim. In `Approval checkpoint`, include
the exact payload, destination, expected cost, rollback or correction path,
`Approver authority status`, `Third-party data status`, and
`Regulated-review status`. Include an explicit yes/no approval request only
when every required prerequisite passes; otherwise print
`Execution blocked — prerequisite unresolved`. Keep the asset staged.
In `Private fulfillment preparation`, include the deliverable workflow,
Confidence
75% confidence
Finding
no approval

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.